https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:38:36.930133+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352918 EUVD-2026-352918 2026-10-04T04:38:36.935989+00:00 EUVD-2026-352918 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58439 fkie_cve-2026-58439 2026-10-04T04:38:36.936045+00:00

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

 https://cve.radiocsirt.org/vuln/ghsa-w5pg-649r-p6gg GHSA-w5pg-649r-p6gg — Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag 2026-10-04T04:38:36.936083+00:00

Affected: Go: code.gitea.io/gitea

## Summary

Gitea does not re-evaluate the `official` flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an `official: true` approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch (e.g., `master`). The approval, which would have been `official: false` if submitted against the protected branch, is preserved and satisfies the protected branch's required approvals, allowing the attacker to merge without legitimate maintainer approval.

- Confirmed on Gitea **1.25.4** (`1.25.4+41-g96515c0f20`)

## Vulnerability Details

### Root Cause

When a review is submitted on a pull request, Gitea computes the `official` flag by checking whether the reviewer is in the **target branch's** approval whitelist (`IsUserOfficialReviewer` in `models/git/protected_branch.go`). This flag is stored in the database as a boolean on the review record.

When a PR's target branch is subsequently changed via `ChangeTargetBranch` (`services/pull/pull.go:218`), the function: - Updates `pr.BaseBranch` - Recalculates merge feasibility and divergence - Deletes old push comments - Creates a "change target branch" comment

But it does **not**: - Re-evaluate `official` on existing reviews - Dismiss existing approvals - Check whether reviewers are in the new target branch's approval whitelist

At merge time, `GetGrantedApprovalsCount` (`models/issues/pull.go:766`) counts reviews where `official =…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen 2026-10-04T04:38:36.936162+00:00

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.